← Back

Draytek

draytek

134 CVEs • 280 products

Products (280)

Click to collapse
Toggle
Vigorconnect
vigorconnect

CVEs (134)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Draytek
1Vigor3900 Firmware
Apr 11, 2025
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function.
1Draytek
1Vigor3900 Firmware
Apr 11, 2025
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function.
1Draytek
1Vigor3900 Firmware
Nov 5, 2024
Nov 1, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function.
1Draytek
1Vigor3900 Firmware
Nov 5, 2024
Nov 1, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function.
1Draytek
1Vigor3900 Firmware
Nov 5, 2024
Nov 1, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function.
1Draytek
1Vigor3900 Firmware
Nov 5, 2024
Nov 1, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function.
1Draytek
1Vigor3900 Firmware
Nov 5, 2024
Nov 1, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 31, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 31, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificate function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 31, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 31, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 30, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 30, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 30, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 30, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 30, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 30, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 30, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function.
1Draytek
1Vigor3900 Firmware
Apr 10, 2025
Oct 30, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn function.
1Draytek
1Vigor2960 Firmware
May 17, 2025
Oct 28, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route...Show more
An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function.Show less